treewide: Make yescrypt the default algorithm for pam_unix.so

This ensures `passwd` will default to yescrypt for newly generated
passwords.

Changed files
+5 -5
nixos
modules
security
services
x11
display-managers
tests
pkgs
build-support
docker
+1 -1
nixos/modules/security/pam.nix
···
optionalString config.services.homed.enable ''
password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
'' + ''
-
password sufficient pam_unix.so nullok sha512
+
password sufficient pam_unix.so nullok yescrypt
'' +
optionalString config.security.pam.enableEcryptfs ''
password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so
+1 -1
nixos/modules/services/x11/display-managers/gdm.nix
···
account sufficient pam_unix.so
-
password requisite pam_unix.so nullok sha512
+
password requisite pam_unix.so nullok yescrypt
session optional pam_keyinit.so revoke
session include login
+1 -1
nixos/modules/services/x11/display-managers/lightdm.nix
···
account sufficient pam_unix.so
-
password requisite pam_unix.so nullok sha512
+
password requisite pam_unix.so nullok yescrypt
session optional pam_keyinit.so revoke
session include login
+1 -1
nixos/tests/pam/test_chfn.py
···
"auth sufficient pam_rootok.so",
"auth sufficient pam_unix.so likeauth try_first_pass",
"password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass",
-
"password sufficient pam_unix.so nullok sha512",
+
"password sufficient pam_unix.so nullok yescrypt",
"session optional @@pam_krb5@@/lib/security/pam_krb5.so",
"session required pam_env.so conffile=/etc/pam/environment readenv=0",
"session required pam_unix.so",
+1 -1
pkgs/build-support/docker/default.nix
···
cat > /etc/pam.d/other <<EOF
account sufficient pam_unix.so
auth sufficient pam_rootok.so
-
password requisite pam_unix.so nullok sha512
+
password requisite pam_unix.so nullok yescrypt
session required pam_unix.so
EOF
fi